When configured with the signed cookie option, the plugin fails to stop processing when a signature check reports an invalid value. Instead, it passes the original cookie value to the session decoder, allowing a session with an invalid signature to be decrypted. This occurs if an application uses a cookie signing secret separate from the session encryption key and rotates only the signing secret. An attacker possessing an unexpired encrypted session cookie can strip the obsolete signature to continue using the session. The attacker cannot forge session data, extend expiry, or bypass rotation of the encryption key.